[00/13] KVM/arm64: Add NV support for ERET and PAuth

Message

Marc Zyngier Feb. 19, 2024, 9:20 a.m. UTC

Although the current upstream NV support has *some* support for
correctly emulating ERET, that support is only partial as it doesn't
support the ERETAA and ERETAB variants.

Supporting these instructions was cast aside for a long time as it
involves implementing some form of PAuth emulation, something I wasn't
overly keen on. But I have reached a point where enough of the
infrastructure is there that it actually makes sense. So here it is!

This series completely relies on my previous VM configuration
enforcement series, as it expects all shadow registers to be sanitised
and to match the VM configuration.

The first 3 patches are only opportunistic cleanups and hardening.

Patch #4 adds the configuration of HCR_EL2 in the NV2 case, together
with VNCR_EL2 being populated.

Patches #5, #7 and #8 add more triage and trap forwarding on the
instruction side (SMC, ERET, PAC)

Patch #6 split the current ERET handling into a fixup which runs early
on exit, and the core part, which is only used when a translation
regime transition or an exception injection needs to take place.

The rest of the series finally adds the PAuth emulation for ERETA[AB]
(and only for these two instructions), plugs it into the ERET
handling, and finally advertises PAuth to the L1 guest.

Marc Zyngier (13):
  KVM: arm64: Harden __ctxt_sys_reg() against out-of-range values
  KVM: arm64: Clarify ESR_ELx_ERET_ISS_ERET*
  KVM: arm64: nv: Drop VCPU_HYP_CONTEXT flag
  KVM: arm64: nv: Configure HCR_EL2 for FEAT_NV2
  KVM: arm64: nv: Add trap forwarding for ERET and SMC
  KVM: arm64: nv: Fast-track 'InHost' exception returns
  KVM: arm64: nv: Honor HFGITR_EL2.ERET being set
  KVM: arm64: nv: Handle HCR_EL2.{API,APK} independantly
  KVM: arm64: nv: Reinject PAC exceptions caused by HCR_EL2.API==0
  KVM: arm64: nv: Add kvm_has_pauth() helper
  KVM: arm64: nv: Add emulation for ERETAx instructions
  KVM: arm64: nv: Handle ERETA[AB] instructions
  KVM: arm64: nv: Advertise support for PAuth

 arch/arm64/include/asm/esr.h            |   4 +-
 arch/arm64/include/asm/kvm_emulate.h    |   5 -
 arch/arm64/include/asm/kvm_host.h       |  26 +++-
 arch/arm64/include/asm/kvm_nested.h     |  13 ++
 arch/arm64/include/asm/pgtable-hwdef.h  |   1 +
 arch/arm64/include/asm/sysreg.h         |   1 +
 arch/arm64/kvm/Makefile                 |   1 +
 arch/arm64/kvm/emulate-nested.c         |  66 +++++---
 arch/arm64/kvm/handle_exit.c            |  38 ++++-
 arch/arm64/kvm/hyp/include/hyp/switch.h |  36 ++++-
 arch/arm64/kvm/hyp/nvhe/switch.c        |   2 +-
 arch/arm64/kvm/hyp/vhe/switch.c         |  95 +++++++++++-
 arch/arm64/kvm/nested.c                 |   8 +-
 arch/arm64/kvm/pauth.c                  | 196 ++++++++++++++++++++++++
 14 files changed, 434 insertions(+), 58 deletions(-)
 create mode 100644 arch/arm64/kvm/pauth.c